JIT Executable Evaluation via Code Object Reputation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for classifying malicious files are ineffective in identifying singletons, which are unique files produced by just-in-time compilation and lack a reputation in reputation systems, leading to false positives and negatives.
Innovation Solution
A computer-implemented method that identifies code objects generated from source code in an intermediate language, determines if an executable file was produced by a just-in-time compiler, retrieves the reputation of the code object, and performs security actions based on this reputation rather than the assigned reputation of the executable file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional reputation systems are used to classify executable files, then files with known reputations can be accurately classified, but singleton files (unique executables from just-in-time compilation) cannot be reliably classified because they lack reputation data
Solution Approach 1:
The patent introduces code objects as an intermediary entity between executable files and the reputation system. Instead of directly classifying executable files (which may be singletons without reputation), the system classifies their underlying code objects. The code object serves as a mediator that can be reliably identified and classified, even when the compiled executable cannot.
Solution Approach 2:
The patent shifts the classification dimension from the executable file level to the code object level. By moving up one dimension in the compilation hierarchy (from compiled executable to source-level code object), the system gains the ability to classify files that are otherwise unclassifiable at the executable level.
2Reliability
If all singleton executables are classified as potentially malicious to improve security, then false positives increase and benign singletons are incorrectly blocked
Solution Approach 1:
By using code objects as intermediaries, the system avoids directly classifying singleton executables. The code object classification provides reliable security assessment without the false positives that occur when singletons are automatically flagged as malicious.
Solution Approach 2:
The system uses reputation data from the classified code object to inform the classification of the executable file. This feedback mechanism allows benign singletons to be correctly identified and allowed, while malicious ones are blocked, reducing false positives while maintaining security.
3Reliability
If all singleton executables are blocked to prevent malware execution, then security improves but legitimate applications from just-in-time compilation are incorrectly prevented from running
Solution Approach 1:
The code object acts as a mediator that enables reliable security assessment without blocking legitimate applications. By classifying the code object rather than the executable, the system can distinguish between malicious and benign singletons, allowing legitimate JIT-compiled applications to run while blocking malware.
Solution Approach 2:
The reputation feedback from code objects enables differentiated treatment of singletons. Benign singletons receive positive feedback and are allowed to execute, while malicious ones receive negative feedback and are blocked, maintaining both security and ease of operation.
Data Source
AI summary
The disclosed computer-implemented method for evaluating unfamiliar executables may include (i) identifying, on the computing device, (a) a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device and (b) an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files, (ii) determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device, (iii) retrieving, from the reputation system, a reputation for the code object, and (iv) performing a security action on the executable file that is based on the reputation of the code object. Various other methods, systems, and computer-readable media are also disclosed.